Do not open a public issue for a vulnerability. Use the repository's private vulnerability reporting on GitHub, which reaches the maintainers alone:

https://github.com/ConcatenaLabs/levo/security/advisories/new

Say what you found, how to reproduce it, and what it lets someone do. The maintainers answer there, and the report stays private until a fix is published. CONTRIBUTING.md carries the rest.